I'm transitioning someone's quite old server [Debian] to a new CentOS6 host. All going pretty well. But they server up some functionality using CGI scripts via Apache that use something referred to on the Debian box as the www-mysql package? This a binary that executes HTML pages containing embedded SQL statements.
Anyone know where the source for this can be found or if it has a more specific name? The 'helpfulness' of search engines is getting in the way of finding the provenance of this code.
On 03/07/12 1:00 PM, Adam Tauno Williams wrote:
This a binary that executes HTML pages containing embedded SQL statements.
I found the debian package here: http://archive.debian.net/etch/www-mysql
ah, and peeking into the source tarball, www-mysql (and www-pgsql) build from www-sql, which comes from here http://www.jamesh.id.au/software/www-sql/
this stuff looks really old, like its not been touched since 1998. its a pretty simple cgi package written in C, so it probably can be built for newer systems.
it also seems like an awful way of doing things. from the man pages, here's a sample cgi sql file... the <! SQL ...> stuff is processed by this extension.
<html> <head><title>Telephone Numbers</title></head> <body> <H1>Telephone Numbers</H1> <!-- Let user change query --> <form action=example.sql> <input name=sur> <input type=submit><br> </form> <! sql connect> <! sql database telephone> <! sql setdefault sur "-"> <! sql setdefault ofs 0> <! sql query "select * from numbers where surname like '?sur' order by firstname limit $ofs,10" q1> <! sql if $NUM_ROWS != 0> <!-- Put in table --> <table> <tr> <th>Surname</th> <th>First Name</th> <th>Number</th> </tr> <! sql print_rows q1 "<tr> <td>@q1.0</td> <td>@q1.1</td> <td>@q1.2</td> </tr>\n"> </table> <!-- Put in navigation links --> <center> <! sql if 9< $ofs> <! sql print "<a href="example.sql?sur=#sur&ofs="><! sql eval $ofs - 10><! sql print "">">Prev</a> <! sql else> Prev <! sql endif> <! sql if $NUM_ROWS = 10> <! sql print "<a href="example.sql?sur=#sur&ofs="><! sql eval $ofs + 10><! sql print "">">Next</a> <! sql else> Next <! sql endif> </center> <! sql endif> <p> <center><em>Page produced by WWW-SQL</em></center> </body> </html>
On Wed, Mar 7, 2012 at 3:26 PM, m.roth@5-cent.us wrote:
Ummm sorry, but pretty much every C program back then would have inherited potential buffer overflow from the standard C libraries. Like if you put a sufficiently long unterminated string in the environment...
-
Adam Tauno Williams -
John R Pierce -
Les Mikesell -
m.roth＠5-cent.us -
Rainer Duffner